Skip to content
Hookgap
Get started
Free tool

MTA-STS checker

Check whether a domain requires encrypted email delivery: the DNS record, the policy file, its mode and mail servers, and TLS reporting.

What MTA-STS protects against

Mail servers usually try to encrypt the connection when they deliver email, but by default they fall back to plain text if encryption fails, and they do not check the certificate. Someone on the network path can strip the encryption and read or alter the message. MTA-STS closes that gap: it publishes a policy saying "only deliver to these servers, and only over verified TLS".

What this checker tests

  1. The DNS record at _mta-sts. plus the domain: exactly one v=STSv1 record with a valid id.
  2. The policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt: HTTPS with a trusted certificate, HTTP 200, no redirect, text/plain.
  3. The policy: version: STSv1, a mode, a sensible max_age, and mx lines that cover every real MX host.
  4. TLS-RPT at _smtp._tls. plus the domain, so failures get reported.

It makes three DNS lookups and one HTTPS request. Setup steps for the two big providers are in MTA-STS in 10 minutes for Microsoft 365 and Google Workspace.

Frequently asked questions

What does MTA-STS do?

MTA-STS (RFC 8461) lets a domain tell sending mail servers that they must use an encrypted, certificate-checked connection when delivering to it. Without it, an attacker on the network path can downgrade the connection to plain text.

What is the difference between testing and enforce mode?

In testing mode senders report failures but still deliver the mail. In enforce mode, senders that support MTA-STS refuse to deliver unless they can connect securely to a mail server listed in the policy.

Do I need TLS-RPT with MTA-STS?

It is not required, but it is how you find out about failures. A TLS-RPT record (RFC 8460) asks senders to email daily reports, which makes it safe to move from testing to enforce.

Why does the policy file need its own subdomain?

Senders fetch the policy from https://mta-sts.<domain>/.well-known/mta-sts.txt, so that host needs a valid certificate and must serve the file directly, without redirects.

Related guides